🇺🇸
TPI-Abuse
2026-10-18 13:58:52
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:58:46.373336 2026] [security2:error] [pid 6442:tid 6442] [client 172.71.148.71:12320] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||midnightscribe.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "midnightscribe.com"] [uri "/midnightscribe.sql"] [unique_id "atTQlgW60c9lEqJTZe86vwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 12:04:15
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 08:04:10.769508 2026] [security2:error] [pid 3643:tid 3643] [client 172.71.148.71:12500] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||zheundu.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "zheundu.com"] [uri "/admin/config.php.bak"] [unique_id "atS1utXliB0dd3zbcpMFQwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 09:40:30
(9 hours ago)
[18/Oct/2026:12:40:29 +0300] -- 172.71.148.71 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:12:40:29 +0300] -- 172.71.148.71 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /rezerv.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
2026-10-18 09:13:46
(10 hours ago)
[Sun Oct 18 11:13:44.877706 2026] [authz_core:error] [pid 2141] [client 172.71.148.71:13251] AH01630 ...
show more
[Sun Oct 18 11:13:44.877706 2026] [authz_core:error] [pid 2141] [client 172.71.148.71:13251] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Sun Oct 18 11:13:45.180263 2026] [authz_core:error] [pid 2141] [client 172.71.148.71:13251] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Sun Oct 18 11:13:45.508636 2026] [authz_core:error] [pid 2141] [client 172.71.148.71:13251] AH01630: client denied by server configuration: /etc/httpd/htdocs
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:16:21
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:16:12.873571 2026] [security2:error] [pid 5086:tid 5086] [client 172.71.148.71:10560] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||artspacecleveland.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artspacecleveland.org"] [uri "/config.php.bak"] [unique_id "atRWHGEIjtaXhERZEL1hLgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
findlab
2026-10-18 05:00:08
(14 hours ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:54:10
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:54:02.106979 2026] [security2:error] [pid 982:tid 982] [client 172.71.148.71:14011] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.register-yacht-seychelles.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.register-yacht-seychelles.com"] [uri "/config.php.bak"] [unique_id "atRQ6ueysE-ktkHD1qDC_gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-18 04:10:45
(15 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:24:18
(23 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:24:12.442390 2026] [security2:error] [pid 25172:tid 25188] [client 172.71.148.71:10007] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nimbll.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nimbll.com"] [uri "/database.sql"] [unique_id "atPZbJLP7lYod71-9f6nUgAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 19:50:43
(23 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 15:50:36.401159 2026] [security2:error] [pid 21905:tid 21905] [client 172.71.148.71:10463] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.watonga.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.watonga.com"] [uri "/rezerv.sql"] [unique_id "atPRjLKoSEeiwOfuuUv_TAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 07:26:27
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:26:22.499256 2026] [security2:error] [pid 1011:tid 1011] [client 172.71.148.71:11921] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.boblog111.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.boblog111.com"] [uri "/config.php.bak"] [unique_id "as8unkUdZAE4eUUdnS_GugAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:47:28
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:47:18.242587 2026] [security2:error] [pid 17032:tid 17032] [client 172.71.148.71:13045] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sierrablue.farm|F|2"] [data ".farm.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sierrablue.farm"] [uri "/sierrablue.farm.sql"] [unique_id "as8XZlWA6ESZ5sgcQHG6ZQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:07:41
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:07:35.434891 2026] [security2:error] [pid 30251:tid 30251] [client 172.71.148.71:14032] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||donnathedoglady.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "donnathedoglady.com"] [uri "/donnathedoglady.sql"] [unique_id "as8OFxBRLx9nYSeq93CNWgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-10-14 03:50:47
(4 days ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:38:19
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.148.71 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:38:14.796933 2026] [security2:error] [pid 9575:tid 9575] [client 172.71.148.71:10287] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||randallbrooks.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "randallbrooks.com"] [uri "/config.php.bak"] [unique_id "as7rFq3tUroQ5EE_wXXphQAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
